| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-09-18 |
| elastic |
Windows Firewall Disabled via PowerShell |
production |
2026-09-18 |
| elastic |
Potential Process Injection via PowerShell |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Special Character Overuse |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Reordering |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Concatenation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Reverse Keywords |
production |
2026-09-18 |
| elastic |
Dynamic IEX Reconstruction via Method String Access |
production |
2026-09-18 |
| elastic |
Potential Dynamic IEX Reconstruction via Environment Variables |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |
| elastic |
Process Injection by the Microsoft Build Engine |
production |
2026-09-18 |
| elastic |
Proxy Execution via Windows OpenSSH |
production |
2026-09-18 |
| elastic |
Command Execution via ForFiles |
production |
2026-09-18 |
| elastic |
Proxy Execution via Console Window Host |
production |
2026-09-18 |
| elastic |
IIS HTTP Logging Disabled |
production |
2026-09-18 |
| elastic |
Process Execution from an Unusual Directory |
production |
2026-09-18 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Potential DLL Side-Loading via Trusted Microsoft Programs |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a System Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
ImageLoad via Windows Update Auto Update Client |
production |
2026-09-18 |
| elastic |
Control Panel Process with Unusual Arguments |
production |
2026-09-18 |
| elastic |
Enable Host Network Discovery via Netsh |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
Potential EDR-Freeze via WerFaultSecure Abuse |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
DNS-over-HTTPS Enabled via Registry |
production |
2026-09-18 |
| elastic |
Disable Windows Event and Security Logs Using Built-in Tools |
production |
2026-09-18 |
| elastic |
Disabling Windows Defender Security Settings via PowerShell |
production |
2026-09-18 |
| elastic |
Disable Windows Firewall Rules via Netsh |
production |
2026-09-18 |
| elastic |
PowerShell Script Block Logging Disabled |
production |
2026-09-18 |
| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
Delete Volume USN Journal with Fsutil |
production |
2026-09-18 |